Draft foundation
Security
This Security overview states practical principles and limitations without certification, security-operations, encryption, or formal SLA claims.
Security approach
OXEFY aims to use practical security principles appropriate to its public website, product communication, and future product workflows. Final implementation details remain subject to technical and legal review.
User-authorized platform connections
Vocalis public positioning describes user-authorized platform connections. Users may connect accounts through provider authorization flows where supported by product configuration and provider access.
Secret and credential handling principles
Users should not submit passwords, API keys, tokens, private keys, payment-card data, government ID, health data, or sensitive personal data through general contact. Public website source must not contain secrets.
Least-necessary access
Public product wording emphasizes least-necessary access and user-directed workflows. Provider access depends on configuration, provider terms, and review.
Publishing control
Publishing workflows should keep user review, destination selection, and approval visible where applicable. Users remain responsible for final content and platform compliance.
Dependency and configuration hygiene
A8 validation checks dependency state, build output, JSON-LD, links, placeholders, secret-like strings, and prohibited public claims. Future backend services require separate operational controls.
Logging and operational visibility
Operational logging details are not finalized. A7 documentation recommends minimal logs and avoiding routine message-body logs for future contact transport.
Vulnerability reporting
Use the Contact route and select Security report until a dedicated security mailbox is confirmed. Do not include credentials or exploit payloads in a general report.
Incident response principles
Incident response details are not finalized. A7 operations documentation recommends disabling affected form transport, preserving minimal operational logs, rotating credentials, and updating public guidance after facts are confirmed.
Security limitations
This overview does not claim certifications, formal penetration testing, continuous monitoring, named encryption algorithms, a formal SLA, or guaranteed security outcomes.
Third-party providers
Third-party providers may operate under their own terms, controls, and availability. Provider-specific details remain pending.
Contact route
Use Contact for security reports until a public security mailbox is created, verified, and approved.
Version history
| Version | Date | Status | Change type |
|---|---|---|---|
| 0.1 | 18 July 2026 | Draft foundation | Initial A8 public foundation |
Registered office
Floor No. 6, Ruia Chambers, In front of Amanora Gold Towers, Amanora Park Town, Hadapsar, Pune - 411028, Maharashtra, India.